PostHog vs Google Analytics

Notice the Headless Chrome row. PostHog's script kept quiet for it; GA4's sent a page view and left the rest to Google's servers.

PostHog's web analytics is one pre-built dashboard: visitors, pages, sources, UTMs, countries and conversion goals. Its own docs say it's built for small teams and marketers, with no custom insights and a limited set of properties; anything deeper is product analytics (PostHog). In a product, that depth is the point. On a site that only publishes, you carry it without using it.

Out of the box, the script records page views, page leaves, clicks and other interactions (autocapture), and dead clicks (config). It also asks PostHog for feature flags as the page loads. In our lab it did that even for the browser it then kept silent.

Notice the last column: PostHog is the pick wherever there's an app.

One developer, measuring side projects, called PostHog overkill when all they wanted was country, source, UTMs, entry page and revenue (Hacker News, April 2026).

Our read: on a site that only publishes, PostHog works, but you pay for it in script weight and a cookie, for features you won't open.

We installed each tool alone on a test page and opened it in Chrome four ways: as a person who moves the mouse and scrolls, and as three kinds of bot. One announces it's automated. One hides that. One clicks without moving the mouse, the way AI agents click. No data reached PostHog or Google: apart from fetching each script, our lab answered every request itself.

Notice the weight row. PostHog's array.js is 105 KB as downloaded, the heaviest we tested after GA4. GA4's tag is 154 KB and Nora's 2.7 KB. Session replay and surveys load more code when you switch them on (PostHog). For one page view by a person, PostHog made 5 requests: its settings, feature flags, a check before sending, and a batch of events on opening and another on leaving.

Then the storage rows. PostHog left ph_<project>_posthog for a year, and these keys in localStorage and sessionStorage: ph_<project>_posthog, ph_<project>_window_id, ph_<project>_primary_window_exists, ph_<project>_session_registered_properties. By default PostHog keeps its full state in localStorage and a smaller part in the cookie (persistence). GA4 left _ga and _ga_<property>. Nora left nothing.

Now the bot rows. PostHog's script checks the user agent against a built-in list of about 77 bots, HeadlessChrome among them, and stays silent on a match (PostHog). So it sent no events for automated Chrome as shipped, though it still fetched its settings and flags. Once the user agent was changed, the disguised browser and the agent-style click went out as ordinary visits, as they did with GA4.

Ad blockers block both. EasyPrivacy, the list most of them use, blocks PostHog's script on i.posthog.com and GA4's tag outright, and PostHog's page-leave beacon falls under its general rule for beacons sent to another site. PostHog suggests a reverse proxy on your own domain (PostHog). The list also blocks scripts from any host whose name starts with posthog., so give the proxy another name (list). Nora isn't on it.

PostHog bills events. With its defaults, each page view sends a $pageview, and leaving the page sends a $pageleave; autocapture adds clicks and other interactions (PostHog). So your bill depends on what your visitors do, and on settings you choose. This table works it through.

Notice the last column. On the free plan you don't pay more as you grow; you lose data. From 1 million page views a month, at least 50% of your events are dropped.

• The free million. Every account gets 1 million events a month, with no card and no time limit. Past it, events cost $0.00005 each up to 2 million, then less as volume grows (pricing).
• What happens past it. On the free plan, events after the first million are dropped for good, so in a busy month nothing after that point is kept (pricing). With a card on file you set a billing limit for each product. Past it, events are dropped too, and PostHog emails you at 80% and 100% (limits).
• Identified events cost more. Once you call identify(), events carry a person profile. PostHog says anonymous ones are up to four times cheaper, and its JavaScript library sends anonymous events by default (PostHog).
• The rest of the free plan. 5,000 recordings a month, then $0.005 each up to 15,000; 1 million feature-flag requests; 1,500 survey responses; one project; data kept a year (pricing).

Surprise bills are a common worry. In 2024 one developer said they ran up a bill of over $10,000 in their first half day, and replies pointed to billing limits (Hacker News). GA4 is free with no monthly cap. Nora is free up to 1 million visitors a month, and it counts visitors, not events.

Run both on one site and the totals won't match. Four things cause most of the gap.

• Consent. In the EEA, the UK and Switzerland, Google requires consent for GA4's cookies (Google), and it models the visitors who decline only on large sites (Google). PostHog sets a cookie by default too, so held behind the same banner, both lose the same people. With cookieless_mode: "on_reject", PostHog still counts visitors who decline, with a hash made on its servers (PostHog).
• Bots. PostHog drops listed bots in the browser, before anything is sent. GA4 drops known bots on its servers and never says how many (Google).
• Blocking. EasyPrivacy blocks both scripts. A PostHog proxy on your own domain gets around those rules, unless its host name begins posthog., which the list also blocks.
• People and sessions. PostHog keeps a visitor's ID in localStorage and in a cookie that lasts a year, and ends a session after 30 minutes without activity (PostHog). GA4's _ga lasts up to 400 days in Chrome (Google).

For a sense of scale: on the first site running Nora, 3.3% of the page views its script saw over nine days in October 2026 were bots or AI agents.

Google Analytics 4 drops known bots using Google's research and the IAB spiders and bots list. It always does, and it never says how many (Google). Since 13 May 2026, an AI Assistant channel groups visits referred by ChatGPT, Gemini, Claude and others, going by the referrer only (Google). Nothing in GA4 labels AI agents.

PostHog handles automated traffic in three places (PostHog).

1. In the browser. Its script drops known bots before they send anything, so that data is gone for good.
2. In reports. It sorts traffic into Regular, AI Agent, Bot and Automation by user agent and published crawler IP ranges, with subtypes such as AI crawler, AI search and AI assistant. PostHog calls this brand new and says names and behaviour may change (PostHog). A Bots tab in Web Analytics is in alpha and rolling out.
3. From your server, since most bots never run JavaScript. You forward access logs as $http_log events, and they're sorted the same way.

PostHog's "AI Agent" means declared AI crawlers and fetchers, such as GPTBot, ClaudeBot, PerplexityBot and ChatGPT-User. By PostHog's own table, an ordinary Chrome user agent is Regular (PostHog). An agent driving a real browser sends one, which is why our disguised and agent-style visitors went out as plain visits.

You can add up to 50 custom rules per project, matching user agent, IP range, host or screen size. For referrals, an AI channel since 28 July 2026 groups ChatGPT, Claude, Gemini and Perplexity, and past sessions were reclassified too (changelog).

Nora keeps every page view and labels it a person, an AI agent or a bot, with the test that caught it: a signature check, the name it gives, how it behaves, or machine signs. In our lab it caught the headless browser and the agent-style click. The disguised browser that never touched the page passed as a person, as it did everywhere.

Our read: PostHog's traffic split goes further than anything in GA4. Its "AI Agent" label still covers the machines that say what they are, not the ones in an ordinary browser.

Crawlers such as GPTBot and ClaudeBot that fetch pages without running scripts need server or CDN logs. PostHog takes them as $http_log events; Nora's log connection isn't ready yet; GA4 has none.

On 27 May 2026, PostHog's chief executive announced that PostHog would train its own AI models on data in PostHog (PostHog). Here's how the post sets it out.

• US cloud: opted in by default. Training was not to start before 29 June 2026.
• EU cloud: opted out by default, along with customers whose agreements rule training out.
• Anonymised, and kept in-house. Data is anonymised first, only data already in your instance is used, and PostHog trains the models itself. It says it won't sell or send the data to third-party model providers.
• You can opt out. An admin can do it at any time in organisation settings. Features built on these models won't be available to accounts that opt out.

So the region you pick at sign-up decides the default. If that matters to you, choose the EU cloud or switch training off in organisation settings. Google's terms for GA4 are separate, and we don't cover them here.

Where PostHog is ahead of both

• Funnels over any event you send (PostHog), and SQL over your raw events when the built-in views run out.
• Session replay, 5,000 recordings a month free (pricing).
• Feature flags and experiments in the same tool, 1 million flag requests a month free.
• Surveys, 1,500 responses a month free.
• Heatmaps, free to ingest; the free plan covers up to 3 pages you choose (PostHog).

Where GA4 is ahead

• Google Ads. Conversions for bidding, audiences and spend against results, built in.
• Search Console reports inside the product. In PostHog it's a data-warehouse source that syncs daily (PostHog).
• No event bill at any traffic, and a free daily BigQuery export of up to 1 million events (Google).
• Nothing in alpha or beta on its web dashboard. PostHog's Live tab and Bots tab are alpha, and its revenue analytics is in beta.

Features from each maker's pages on 13 October 2026.

We read reviews and threads from the past two years. The same few things come up again and again. Here they are, in our words, with links to where people said them.

1. Pick the region first. US (Virginia) or EU (Frankfurt) decides where your data sits and the AI-training default (regions).
2. Decide on cookies. Keep the default cookie and localStorage, or use cookieless_mode "always" or "on_reject", after switching on the server hash setting (PostHog).
3. Trim autocapture and set a billing limit if the bill matters (cutting costs).
4. Proxy the script through your own domain, on a host name that doesn't begin posthog., which EasyPrivacy blocks.
5. Bring GA4 across. Link it as a data-warehouse source for daily reports (source), or migrate raw events through GA4's BigQuery export. Historical imports are free but need a paid plan sign-up (migration).
6. Run both for two to four weeks, and keep GA4 if you buy Google Ads.
7. Forward server logs as $http_log if you want to see crawlers.

Self-hosting is possible, with limits. The free hobby deploy runs on one machine of about 4 vCPU and 16 GB of RAM, comes with no support, and PostHog says it's unlikely to scale past a couple of hundred thousand events (self-host, disclaimer). Rybbit's founder said a 64 GB server ran all 16 cores at 100% and still didn't work (Hacker News).

Nora is for the site that publishes: a blog, docs, a marketing site. There, the questions are how many people came, from where, to which pages, and how much of the traffic was people at all. It's free up to 1 million visitors a month, sets no cookies, weighs 2.7 KB, and labels every page view person, AI agent or bot, with the test that caught it. You also get live visitors, pages, sources (AI assistants among them), countries, goal pages, a weekly email and CSV export.

It does none of what PostHog is for. There are no funnels, no feature flags or experiments, and no session recordings, ever. You can't host it yourself, it isn't open source, its data is in the US, and it can't import your GA history. It launches on 1 November 2026, so it has no track record yet. If you're building a product with sign-ups, PostHog is the better pick, and GA4 stays the pick for Google Ads.

Nora Lab, the research team at Nora Analytics, ran every test on this page the same way for each tool. Here is exactly how, so you can judge the results yourself.

The full method, with what each visitor stands for, is on How we test. Every result from the lab run is public as JSON.